diff --git a/.woodpecker.yml b/.woodpecker.yml
index 0dee6f0..32f2147 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -9,13 +9,12 @@ steps:
 
         mkdir -p ~/.ssh
 
-        # ── Install known-hosts from Secret Manager ────────────────
+        # ── Secrets for SSH ────────────────────────────────────────
         gcloud secrets versions access latest \
           --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
           | base64 -d > ~/.ssh/known_hosts
         chmod 644 ~/.ssh/known_hosts
 
-        # ── Install private key ───────────────────────────────────
         gcloud secrets versions access latest \
           --secret=STAGING_SSH_KEY --project=aptivaai-dev \
           | base64 -d > ~/.ssh/id_ed25519
@@ -23,15 +22,21 @@ steps:
 
         echo "🔑 SSH prerequisites installed"
 
-        # ── Resolve tag from commit SHA ───────────────────────────
-        TAG=$(echo "${CI_COMMIT_SHA:-$CI_COMMIT:-$DRONE_COMMIT_SHA}" | head -c 8)
-        if [ -z "$TAG" ]; then
-          echo "❌ No valid commit SHA found. Aborting."
+        # ── Log what the CI knows ──────────────────────────────────
+        echo "🔍 CI_COMMIT_SHA: ${CI_COMMIT_SHA:-unset}"
+        echo "🔍 CI_COMMIT: ${CI_COMMIT:-unset}"
+        echo "🔍 DRONE_COMMIT_SHA: ${DRONE_COMMIT_SHA:-unset}"
+
+        # ── Resolve tag safely ─────────────────────────────────────
+        RAW_SHA="${CI_COMMIT_SHA:-${CI_COMMIT:-${DRONE_COMMIT_SHA:-}}}"
+        if [ -z "$RAW_SHA" ]; then
+          echo "❌ CI commit SHA not found. Aborting."
           exit 1
         fi
+        TAG=$(echo "$RAW_SHA" | head -c 8)
         echo "🚀 Deploying tag ${TAG} to staging"
 
-        # ── SSH into staging and refresh stack ─────────────────────
+        # ── SSH into staging and refresh ───────────────────────────
         ssh -o StrictHostKeyChecking=yes \
             -i ~/.ssh/id_ed25519 \
             jcoakley@10.128.0.12 \
@@ -44,9 +49,9 @@ steps:
              echo '✅ Staging stack refreshed with tag ${IMG_TAG}'"
 
 environment:
-  - CI_COMMIT_SHA
-  - CI_COMMIT
-  - DRONE_COMMIT_SHA
+  CI_COMMIT_SHA: ${CI_COMMIT_SHA}
+  CI_COMMIT: ${CI_COMMIT}
+  DRONE_COMMIT_SHA: ${DRONE_COMMIT_SHA}
 
 when:
   event: